Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
The pako npm package is a high-speed zlib port to JavaScript which works in the browser and node.js. It provides compression and decompression functionalities using the zlib library, which is widely used for data compression.
Compression
This feature allows you to compress a string or binary data using pako's deflate method.
const pako = require('pako');
const input = 'String to compress';
const compressed = pako.deflate(input);
Decompression
This feature allows you to decompress data that was compressed using pako's deflate method or compatible zlib compression.
const pako = require('pako');
const compressed = new Uint8Array([]); // Use a previously compressed Uint8Array
const decompressed = pako.inflate(compressed);
Gzip Compression
This feature allows you to compress data using gzip, which is a file format and a software application used for file compression and decompression.
const pako = require('pako');
const input = 'String to compress';
const compressed = pako.gzip(input);
Gzip Decompression
This feature allows you to decompress data that was compressed using pako's gzip method.
const pako = require('pako');
const compressed = new Uint8Array([]); // Use a previously gzip compressed Uint8Array
const decompressed = pako.ungzip(compressed);
The zlib package is a core module in Node.js for compression/decompression. It is similar to pako but is built into Node.js and does not work in the browser without additional bundling or shimming.
JSZip is a library for creating, reading, and editing .zip files with JavaScript, with a lovely and simple API. While pako focuses on zlib compression, JSZip provides additional functionalities to handle zip files.
Compressjs is a pure JavaScript implementation of various data compression algorithms, such as Huffman coding and Burrows-Wheeler transform. It offers a wider range of algorithms than pako, but it might not be as optimized for speed.
fflate is a high-performance, low-level deflate/inflate compression library that is faster than pako on most benchmarks. It is a newer library that focuses on performance and efficiency.
zlib port to javascript, very fast!
Why pako is cool:
This project was done to understand how fast JS can be and is it necessary to develop native C modules for CPU-intensive tasks. Enjoy the result!
Benchmarks:
node v12.16.3 (zlib 1.2.9), 1mb input sample:
deflate-imaya x 4.75 ops/sec ±4.93% (15 runs sampled)
deflate-pako x 10.38 ops/sec ±0.37% (29 runs sampled)
deflate-zlib x 17.74 ops/sec ±0.77% (46 runs sampled)
gzip-pako x 8.86 ops/sec ±1.41% (29 runs sampled)
inflate-imaya x 107 ops/sec ±0.69% (77 runs sampled)
inflate-pako x 131 ops/sec ±1.74% (82 runs sampled)
inflate-zlib x 258 ops/sec ±0.66% (88 runs sampled)
ungzip-pako x 115 ops/sec ±1.92% (80 runs sampled)
node v14.15.0 (google's zlib), 1mb output sample:
deflate-imaya x 4.93 ops/sec ±3.09% (16 runs sampled)
deflate-pako x 10.22 ops/sec ±0.33% (29 runs sampled)
deflate-zlib x 18.48 ops/sec ±0.24% (48 runs sampled)
gzip-pako x 10.16 ops/sec ±0.25% (28 runs sampled)
inflate-imaya x 110 ops/sec ±0.41% (77 runs sampled)
inflate-pako x 134 ops/sec ±0.66% (83 runs sampled)
inflate-zlib x 402 ops/sec ±0.74% (87 runs sampled)
ungzip-pako x 113 ops/sec ±0.62% (80 runs sampled)
zlib's test is partially affected by marshalling (that make sense for inflate only). You can change deflate level to 0 in benchmark source, to investigate details. For deflate level 6 results can be considered as correct.
Install:
npm install pako
Full docs - http://nodeca.github.io/pako/
const pako = require('pako');
// Deflate
//
const input = new Uint8Array();
//... fill input data here
const output = pako.deflate(input);
// Inflate (simple wrapper can throw exception on broken stream)
//
const compressed = new Uint8Array();
//... fill data to uncompress here
try {
const result = pako.inflate(compressed);
// ... continue processing
} catch (err) {
console.log(err);
}
//
// Alternate interface for chunking & without exceptions
//
const deflator = new pako.Deflate();
deflator.push(chunk1, false);
deflator.push(chunk2); // second param is false by default.
...
deflator.push(chunk_last, true); // `true` says this chunk is last
if (deflator.err) {
console.log(deflator.msg);
}
const output = deflator.result;
const inflator = new pako.Inflate();
inflator.push(chunk1);
inflator.push(chunk2);
...
inflator.push(chunk_last); // no second param because end is auto-detected
if (inflator.err) {
console.log(inflator.msg);
}
const output = inflator.result;
Sometime you can wish to work with strings. For example, to send stringified objects to server. Pako's deflate detects input data type, and automatically recode strings to utf-8 prior to compress. Inflate has special option, to say compressed data has utf-8 encoding and should be recoded to javascript's utf-16.
const pako = require('pako');
const test = { my: 'super', puper: [456, 567], awesome: 'pako' };
const compressed = pako.deflate(JSON.stringify(test));
const restored = JSON.parse(pako.inflate(compressed, { to: 'string' }));
Pako does not contain some specific zlib functions:
deflateCopy
, deflateBound
, deflateParams
,
deflatePending
, deflatePrime
, deflateTune
.inflateCopy
, inflateMark
,
inflatePrime
, inflateGetDictionary
, inflateSync
, inflateSyncPoint
, inflateUndermine
.Available as part of the Tidelift Subscription
The maintainers of pako and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source dependencies you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact dependencies you use. Learn more.
Personal thanks to:
Original implementation (in C):
/lib/zlib
folder/lib/zlib
content[2.1.0] - 2022-11-07
zlib
1.2.12.tree.js
for Babel compatibility, #262.FAQs
zlib port to javascript - fast, modularized, with browser support
The npm package pako receives a total of 21,659,184 weekly downloads. As such, pako popularity was classified as popular.
We found that pako demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.